Re: How to validate passwords without storing them anywhere.

[dr2@xxxxxxxx]

EXACTLY!   If you use a standardized hashing process to hash the PW then
compare against hash results, you don't have to keep the pw recoverable
anywhere!  Maybe consider SHA-1/2/etc or some other published secure
hashing algorithm and please make sure your hash results are long enough
to deter most would be hackers...   

On 2021-03-17 15:19, Scott Klement wrote:

> Rob,
>
> I agree with Calvin.  Consider using a one-way hash instead of an encrypted word. Each time you receive a password, salt it, then hash it.  If creating the user, store the hashed value.  If checking a password, compare the hashed value to the stored one.
>
> -SK
>
> On 3/17/2021 1:46 PM, Calvin Buckley wrote: 
>
> > This sample is really concerning without any attention to salting... or
> > cryptography. Not only is 3DES very busted, it's also not the
> > appropriate algorithm assuming it's secure. You'd want one-way hashing
> > (the archetypical example is MD5, but it too is old and busted), plus
> > salting so someone can't just precompute a bunch of hashes.
> >
> > Ideally, you'd want password hashing algorithms designed special-
> > purpose, like bcrypt (disclaimer: I have an ILE port of bcrypt, all
> > open source). Those are specifically optimized for password hashing by
> > being expensive to hash, whereas MD5/SHA are designed to be cheap
> > (because they're designed for general integrity).